Actually, the password is encrypted using the loaded encryption module (blowfish by default).
As for the blowfish-module, it uses a one-way encryption.
The one-way encryption is achieved by using the password itself as the key (generating the cipher-stream), to encrypt a fixed salt.
Reverse-engineering the key for the cipher-stream would be virtually impossible given the small size of the final hash (~768 bits).